v0 app security checklist for a live Next.js site
An app built with v0 is a Next.js app, so the main rule is the Next.js one. Anything with the NEXT_PUBLIC_ prefix is public, and everything else stays on the server. Atlas, our example app at atlas.example, shows how to check it.
Which variables reach the browser?
v0 says only variables prefixed with NEXT_PUBLIC_ are exposed to the browser. Next.js inlines a NEXT_PUBLIC_ value into any JavaScript sent to the browser. That makes the prefix a decision about publishing, not a naming style.
| Variable | Prefix | Who can read it |
|---|---|---|
| Analytics site id | NEXT_PUBLIC_ | Anyone who opens the site |
| Database publishable key | NEXT_PUBLIC_ | Anyone, so access rules must protect the data |
| AI provider or payment secret key | none | Only your server code |
v0 analyzes NEXT_PUBLIC_ usage and warns about potential security risks. Its own docs say never to expose sensitive tokens with the NEXT_PUBLIC_ prefix. If a secret ever had the prefix, assume it was published and replace it.
Where should a call with a secret run?
In a Route Handler or a Server Action, never in a client component. The browser calls your route, and your route calls the provider with the key. The key never leaves the server.
How to check the live site
- Deploy the app and copy its production address.
- Run a quick check on your published address to see what a stranger sees, then read how we check for what it covers.
- Paste each fix prompt into v0, review the change and deploy again.
An outside check reads the scripts your live site serves, so it can spot a key that slipped into the bundle. It cannot read your Vercel project settings or your server code.
Questions people ask
Is every NEXT_PUBLIC_ variable a leak?
No. Many public values are meant to be public. It is a leak only when the value is a secret, like a payment or AI provider secret key.
Does renaming a variable remove it from a live site?
Only after you deploy again. The old value stays in the built files until a new build replaces them, so replace the key too.
See what your site shows from outside
A quick check reads your homepage the way a visitor would and gives you a score. No account needed.
Check your siteSources
- How to use environment variables in Next.js Next.js docs, read on October 6, 2026
- Security v0 docs, read on October 6, 2026